Description
A local low privileged attacker can move arbitrary physical memory content via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Beckhoff Automation | TcRouter.sys for Windows on x86 3.1.0.2364 | 3.1.0.2364 | — |
| Beckhoff Automation | TwinCAT.XAR.Base.KM <3.18.1 | 1.0.0 <3.18.1 | — |
| Beckhoff Automation | TcRouter.sys for Windows on x86 <3.1.0.2365 | 1.0.0 <3.1.0.2365 | — |
| Beckhoff Automation | TcRouter.sys for Windows on x64 3.1.0.2364 | 3.1.0.2364 | — |
| Beckhoff Automation | TcRouter.sys for Windows on x64 <3.1.0.2365 | 1.0.0 <3.1.0.2365 | — |
| Beckhoff Automation | TwinCAT.XAR.Base.KM 3.16.29 | 3.16.29 | — |
Advisories 1
- VDE-2026-087 Beckhoff: Exposed IOCTLs with insufficient access control in TcRouter.sys CERT@VDE · Nov 11, 2026